axios prototype-pollution gadget in config merge enabling credential theft and response hijacking

#!/usr/bin/env python3
# check_axios_cve_2026_44495.py
# Detect vulnerable axios versions for CVE-2026-44495.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import json
import os
import sys
from typing import List, Optional, Tuple

AFFECTED_RANGES = [
    ((1, 0, 0), (1, 15, 2)),   # >=1.0.0, <1.15.2
    ((0, 19, 0), (0, 31, 1)),  # >=0.19.0, <0.31.1
]


def parse_ver(v: str) -> Optional[Tuple[int, int, int]]:
    if not v:
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    core = v.split('-')[0].split('+')[0]
    parts = core.split('.')
    nums = []
    for p in parts:
        digits = ''
        for ch in p:
            if ch.isdigit():
                digits += ch
            else:
                break
        if digits == '':
            nums.append(0)
        else:
            nums.append(int(digits))
    while len(nums) < 3:
        nums.append(0)
    return tuple(nums[:3])


def is_affected(v: str) -> Optional[bool]:
    pv = parse_ver(v)
    if pv is None:
        return None
    for low, high in AFFECTED_RANGES:
        if pv >= low and pv < high:
            return True
    return False


def walk_deps(dep_obj, found: List[Tuple[str, str, str]], source: str, path: str = ''):
    if not isinstance(dep_obj, dict):
        return
    for name, meta in dep_obj.items():
        if not isinstance(meta, dict):
            continue
        ver = meta.get('version')
        current_path = f"{path}>{name}" if path else name
        if name == 'axios' and isinstance(ver, str):
            found.append((source, current_path, ver))
        nested = meta.get('dependencies')
        if isinstance(nested, dict):
            walk_deps(nested, found, source, current_path)


def inspect_package_lock(lock_path: str, found: List[Tuple[str, str, str]]):
    try:
        with open(lock_path, 'r', encoding='utf-8') as f:
            data = json.load(f)
    except Exception:
        return

    # npm lockfile v2/v3
    packages = data.get('packages')
    if isinstance(packages, dict):
        for pkg_path, meta in packages.items():
            if not isinstance(meta, dict):
                continue
            if pkg_path.endswith('node_modules/axios'):
                ver = meta.get('version')
                if isinstance(ver, str):
                    found.append((lock_path, pkg_path, ver))

    # npm lockfile v1 style
    deps = data.get('dependencies')
    if isinstance(deps, dict):
        walk_deps(deps, found, lock_path)


def inspect_node_modules(base: str, found: List[Tuple[str, str, str]]):
    pkg_json = os.path.join(base, 'node_modules', 'axios', 'package.json')
    if not os.path.isfile(pkg_json):
        return
    try:
        with open(pkg_json, 'r', encoding='utf-8') as f:
            data = json.load(f)
        ver = data.get('version')
        if isinstance(ver, str):
            found.append((pkg_json, 'node_modules/axios', ver))
    except Exception:
        return


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_axios_cve_2026_44495.py /path/to/app')
        sys.exit(3)

    target = os.path.abspath(sys.argv[1])
    if not os.path.exists(target):
        print(f'UNKNOWN - path does not exist: {target}')
        sys.exit(3)

    found: List[Tuple[str, str, str]] = []

    if os.path.isfile(target):
        name = os.path.basename(target)
        if name in ('package-lock.json', 'npm-shrinkwrap.json'):
            inspect_package_lock(target, found)
        else:
            print('UNKNOWN - provide an app directory or package-lock.json/npm-shrinkwrap.json')
            sys.exit(2)
    else:
        for root, dirs, files in os.walk(target):
            # keep traversal bounded-ish
            if '.git' in dirs:
                dirs.remove('.git')
            if name := next((x for x in ('package-lock.json', 'npm-shrinkwrap.json') if x in files), None):
                inspect_package_lock(os.path.join(root, name), found)
            inspect_node_modules(root, found)

    # de-duplicate
    uniq = []
    seen = set()
    for item in found:
        if item not in seen:
            uniq.append(item)
            seen.add(item)

    if not uniq:
        print('UNKNOWN - no axios installation or supported npm lockfile evidence found')
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for source, dep_path, ver in uniq:
        affected = is_affected(ver)
        rec = f'{ver} [{dep_path}] ({source})'
        if affected is True:
            vulnerable.append(rec)
        elif affected is False:
            patched.append(rec)
        else:
            unknown.append(rec)

    if vulnerable:
        print('VULNERABLE - CVE-2026-44495 affected axios versions detected:')
        for r in vulnerable:
            print(f'  - {r}')
        if patched:
            print('Also found patched versions:')
            for r in patched:
                print(f'  - {r}')
        sys.exit(1)

    if patched and not unknown:
        print('PATCHED - only fixed axios versions detected:')
        for r in patched:
            print(f'  - {r}')
        sys.exit(0)

    print('UNKNOWN - no vulnerable versions detected, but some evidence was inconclusive:')
    for r in patched:
        print(f'  - patched: {r}')
    for r in unknown:
        print(f'  - unknown: {r}')
    sys.exit(2)


if __name__ == '__main__':
    main()